A browser agent reads web pages, emails and documents that its user did not write. Any of them can carry instructions meant for the agent rather than the user. In November 2025, presenting Claude Opus 4.5 as its new model, Anthropic published a short post on this threat, prompt injection, which it defines as "adversarial instructions hidden within the content that AI models process". The post reports progress on defenses and uses that progress to justify moving the Claude for Chrome extension from research preview to beta for Max plan users. It also says plainly that the problem is "far from a solved problem".
For this library the post is a short record of how Anthropic described one class of agent risk and the layered response to it at the time: some defenses inside the model, some around it.
Why browser use raises the risk
The post illustrates the threat with an example ("Why browser use creates unique prompt injection risks"). A user asks Claude to read recent emails and draft replies to meeting requests. One email, apparently from a vendor, contains instructions in white text, invisible to the user, telling the agent to forward any email containing the word "confidential" to an outside address first. A successful injection would leak those emails while the user waits for the drafts.
All agents that process untrusted content face this risk, but the post names two reasons browsers amplify it:
- A large attack surface. Every web page, embedded document, advertisement and dynamically loaded script is a possible carrier of instructions.
- Many possible actions. A browser agent can navigate, fill in forms, click buttons and download files, all of which an attacker can exploit once it influences the agent.
Defenses described
The post groups its work into three areas ("Claude's progress on browser use robustness"):
- Training the model. Anthropic uses reinforcement learning to build robustness into the model: during training Claude sees prompt injections embedded in simulated web content and is rewarded for identifying and refusing malicious instructions, "even when those instructions are designed to appear authoritative or urgent".
- Classifiers on untrusted content. All untrusted content entering the model's context is scanned by classifiers that look for injected commands in forms such as hidden text, manipulated images and deceptive interface elements, and that adjust Claude's behavior when an attack is detected. The post links these classifiers to Anthropic's Constitutional Classifiers work, and says both the classifiers and the intervention that guides the model after a detection have improved since the research preview.
- Human red teaming. The post states that human security researchers "consistently outperform automated systems at discovering creative attack vectors". An internal red team probes the browser agent continuously, and Anthropic takes part in external arena-style challenges that compare robustness across the industry.
What it reports
The post's single measurement is a chart, with the following description in the text. The current Claude browser extension was compared with the original launch configuration against an internal "Best-of-N" attacker, an adaptive attacker that tries and combines many prompt injection techniques known to work. The attacker was given 100 attempts per environment, and attack success rate was computed "as a percentage of attacks encountered by each model". The text says Claude Opus 4.5 is more robust in browser use than previous models and that the new safeguards improve safety "across all Claude models". It names one figure: "A 1% attack success rate", which it describes as "a significant improvement" that "still represents meaningful risk". The other values are given only in the chart, which this note does not reproduce.
Limitations and open questions
The post is short and gives no description of the test environments, the number of environments, the injection techniques or how the attacker adapts. It does not separate the contributions of model training and of classifiers to the improvement, and it does not report false positives, the rate at which legitimate content is flagged. The 1% figure applies to Anthropic's own attacker; the post itself states that human researchers find attacks automated systems miss. The authors' own caveat is that "No browser agent is immune to prompt injection" and that the results show progress, not a solution.
Research questions
- How much of the improvement comes from training and how much from classifiers? The post describes both but reports one combined result. Evaluating the model with and without the classifiers, against the same attacker, would separate them.
- What is the false-positive cost of scanning all untrusted content? The post reports attack success but not how often legitimate pages are flagged or tasks interrupted. A benign task set run with and without classifiers would measure it.
- How does success against the automated attacker compare with success by human red teamers? The post says humans find more creative attacks. Reporting attack success rates from the internal red team and from arena challenges alongside the Best-of-N result would show the gap.
- Does training to resist injections change other behavior? Training rewards refusal of instructions found in content. Measuring whether trained models also ignore legitimate instructions found in documents the user asks them to follow would show any side effect.
- What does 1% mean at the scale of real use? An attack success rate is per attack encountered. Estimates of how often agents meet injection attempts in deployment would turn the rate into expected incidents.
How it connects
- Classifier defenses. The post links its content classifiers to Constitutional Classifiers (February 2025), Anthropic's classifier approach to universal jailbreaks.
References
- Anthropic. (2025, November 24). Mitigating the risk of prompt injections in browser use. https://www.anthropic.com/research/prompt-injection-defenses